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Amendment dated February 1 7, 2006 

After Final Office Action of January 17, 2006 

REMARKS 

Claims 1-76, 78-80, and 82-99 are pending in this application. The final Office Action 
mailed October 19, 2005 and Advisory Action mailed January 17. 2006 rejected claims 1-76, 78-80, 
and 82-99. No claims have been amended in the present response. No new matter has been added. 
For the reasons discussed in detail below. Applicants submit that the pending claims are patentable 
over the references cited by the Examiner. Applicants respectfully request that the Examiner pass 
this application to issue. 

Telephonic laterview with the Examincri 

A telephone conference was held between Jamie Wiegand and the Examiner on February 15, 
2006 to discuss the rejections of the Applicants' claims. During the conference, it was presented 
that U.S. Patent No. 6,141 ,686 to Jackov/ski et al C*Jackowski") neither teaches nor suggests 
examining the payload portion of the data to recognize a predefined data type as recited in the 
Applicants' claims. After a careful review, the Examiner responded, in a subsequent telephone call, 
that he agreed that the combination of references does not render the Applicants' claims obvious. 
Although this argument was submitted in the Applicants' response to the final office action mailed 
December 1 6, 2005, the Examiner requested that the argument be resubmitted in writing. In light of 
the Examiner's request, the following is submitted. The Applicants wish to thank the Examiner for 
his willingness to participate in the telephone conference after a final office and advisory action, and 
to review the rejections. 

Rejection of Claims Under 35 U>S,C, 6 103 over Wasilewski and Jackowski 

The Office Action rejected claims 1-14. 16-21. 23-25, 29-30, 36, 39-40, 42, 48-50, 53- 
57, 61-63, 65-70, 73-76, 78-80, 84-89, and 94-97 under 35 U.S.C, § 103(a) as being unpatentable 
over U.S. Patent No- 5,420,866 to Wasilewski ("Wasilewski") in view of U.S. Patent No. 6,141,686 
to Jackowski et al ("Jackowski*^). Applicants respectfully traverse these rejections. 
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The cited prior art references do not disclose or suggest all of the limitations of the 
amended claims. For example, Applicants respectfully disagree that Jackowski discloses or 
suggests determining if a payload portion is to be encrypted by examining the payload portion. 

Instead, Jackowski describes an application-classifier plugin that intercepts network 
traffic at above the client's TCP/TP stack and associates applications and users with the network 
packets. (Jackowski, Abstract). Jackowski*s interceptor is coupled between a high-level network 
socket library and a lower interface that formats data for transmission over the network- (See 
Jackowski, Col 4, Ins. 51-59; See also Figiu^es 4-5). An examiner is coupled to the interceptor The 
examiner examines network events and collects information that includes a process identifier of a 
running instance of a high-level user application. (See Jackowski, Col 4, Ins. 61- Col 5, Ins. 1-6). 
Jackowski points out that such high-level applications (that are running on the client) send and 
receive information to a network by making calls to Win$ock-2 library. These calls use an 
applications-programming interface (API), (Jackowski, Col 7, Ins. 60-62), Events then are 
generated by the Winsock-2 library when a high-level application starts or ends, when it opens or 
closes a socket, when the coimection state of the socket changed, and when data is sent or received. 
(Jackowski, Col 9, his. 37-43). The unique process ID for the Winsock high-level applications that 
originated the event is stored. The name of the high-level application is retrieved using the Win32 
API library call. (Jackowski, Col 10, Ins. 58-64). Inforaiation about the high-level applications is 
stored in tables (current tables and historical tables). (Jackowski, Col 11, Ins. 47-55; See also 
Figure 8). 

Thus, as can be seen, Jackowski obtains information about network packets not by 
examininp: the payload portion of the data as claimed by the Applicants, but rather by monitoring 
high-level applications nmning on the client and events that employ the Winsock library. 
Jackowski examines its tables when an event is detected and makes a decision on how to manage 
the packets based on examining the tables to deteraiine the high-level application associated with 
the packet. (Jackowski, Col 15. his. 8-13; Col. 15, his. 27-33; and Col. 16, Ins, 1-4). Therefore. 
Jackowski does not examine the payload portion of the data as required by the claims. For at least 
these reasons, the cited references do make obvious the Applicants' claimed invention, 
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For the reasons above, the rejections under 35 U.S.C. § 103(a) of independent Claims 1, 
17, 36, 53, 61, 67, 73, 78, 86, and 97 over Wasilewski in view of Jackowski should be withdrawn. 

Furthermore, dependent claims are patentable for at least the same reasons as the 
independent claims from which the dependent claims depend. Accordingly, the rejection under 35 
U-S-C. § 103(a) of dependent Claims 2-14, 16, 18-21, 23-25, 29, 30, 39, 40, 42, 48-50, 54-57, 62, 
63, 65, 66, 68-70, 74-76, 79, 80, 84, 85, 87-89, and 94-96 should also be withdrawn. 

CONCLUSION 

By the foregoing explanations. Applicants believe that this response has responded fully 
to all of the concerns expressed in the OfiGce Action, and believes that it has placed each of the 
pending claims in condition for immediate allowance. Accordingly, the Examiner is respectfully 
requested to pass this application to issue. Should any further aspects of the application remain 
unresolved, the Examiner is invited to telephone applicant's attorney at the number listed below. 

Dated: February 17, 2006 Respectfully submitted. 




/^Registration No,: 52.361 
DARBY & DARBY P.C, 
P.O. Box 5257 

New York, New York 1 01 50*5257 
(206) 262-8900 
(212) 527-7701 (Fax) 
Attorneys/Agents For Applicant 
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